ESG Assurance 101: Limited vs. Reasonable Assurance

ESG assurance is an independent verification engagement in which a qualified practitioner evaluates whether a company’s sustainability disclosures are free from material misstatement and fairly presented under an applicable reporting framework. It provides stakeholders, including investors, lenders, and regulators, with a level of confidence in the reliability of reported environmental, social, and governance data that self-reported figures alone cannot deliver. Two levels exist: limited assurance, which yields a negative-form conclusion, and reasonable assurance, which delivers a higher-confidence positive opinion. The choice between them drives scope, cost, and the credibility signal sent to the market.

Why ESG Assurance Is on Every CFO’s Radar Right Now

Sustainability reporting has moved from a voluntary, narrative exercise to a data-intensive process that faces growing external scrutiny. Several converging forces are accelerating demand for independent assurance.

Regulatory momentum. The European Union’s Corporate Sustainability Reporting Directive (CSRD) requires in-scope companies to obtain third-party assurance on their sustainability statements. Under the EU’s “Omnibus I” simplification directive, adopted by the EU Council on February 24, 2026, published in the Official Journal on February 26, 2026 as Directive (EU) 2026/470, and in force since March 18, 2026, the CSRD scope was narrowed to large undertakings with more than 1,000 employees and net annual turnover exceeding EUR 450 million. The narrowed scope applies for financial years beginning on or after January 1, 2027. The Omnibus also settled the assurance level: limited assurance remains the mandatory standard, and the European Commission is to adopt a limited assurance standard by July 1, 2027. The previously planned automatic escalation to reasonable assurance was removed, so there is no longer a mandated transition to reasonable assurance under CSRD. Even with the narrowed scope, thousands of European and multinational entities remain in mandatory assurance territory.

Investor expectations. Institutional investors increasingly treat unverified ESG disclosures as noise. Limited partners in private equity funds want auditable sustainability metrics that feed into their own portfolio-level risk management. Lenders tie green-loan pricing to verified emissions data. Third-party assurance converts a self-reported number into something that can actually be relied upon.

The US picture. The SEC adopted a climate disclosure rule on March 6, 2024, then stayed it in April 2024 pending litigation. The Commission voted 2-1 to end its defense of that rule on March 27, 2025. In late May 2026 the SEC proposed a formal rescission of the rule, published in the Federal Register on June 3, 2026, with public comments due by August 3, 2026. As of September 2026 the comment period has closed and a final rescission vote is still pending. For now there is no federal US mandate for ESG disclosure or its assurance. That does not mean assurance demand has disappeared. Large US companies with EU operations or EU-listed securities remain in scope of CSRD, and voluntary assurance continues to grow as a credibility signal to the capital markets.

Understanding the Two Levels of ESG Assurance

Limited Assurance

Limited assurance is the more accessible entry point. The practitioner performs primarily inquiry and analytical procedures, rather than detailed substantive testing of underlying source data.

The conclusion takes a negative form: the practitioner states that nothing came to their attention that would suggest the sustainability information is materially misstated. This is sometimes called a “no evidence of departure” conclusion. Limited assurance does not mean weak assurance; the practitioner must still understand the subject matter, assess risks, and design procedures responsive to those risks. But the depth and breadth of procedures are calibrated to a lower detection threshold than reasonable assurance.

Common procedures under limited assurance include:

• Inquiries of management and those responsible for data collection
• Analytical comparisons of reported metrics against prior periods or external benchmarks
• Review of documentation supporting key figures (for example, utility bills underlying Scope 1 and Scope 2 greenhouse gas calculations)
• Walkthroughs of internal controls over sustainability data
• Tracing selected data points back to source systems or third-party inputs

Limited assurance is often the starting point for companies new to external verification. It is also the minimum required for the first wave of CSRD-reporting entities.

Reasonable Assurance

Reasonable assurance is the higher tier. Procedurally, it mirrors a financial statement audit: the practitioner identifies and assesses risks of material misstatement at the assertion level for each material disclosure, designs substantive tests responsive to those risks, and gathers sufficient appropriate evidence to support a positive-form conclusion.

The conclusion states that the sustainability information is, in all material respects, fairly presented in accordance with the applicable criteria. This affirmative opinion carries significantly more weight with investors and regulators than the negative-form limited assurance conclusion.

Reasonable assurance procedures typically add:

• Substantive testing of transactions and underlying records
• Site visits to key facilities to observe data collection processes firsthand
• Independent recalculation of emissions, energy, or water figures from raw inputs
• Detailed testing of the completeness and accuracy of the reporting population
• Assessment of the design and operating effectiveness of relevant controls

The tradeoff is time and cost. A reasonable assurance engagement on a full ESG report can require materially more hours than a limited assurance engagement over the same scope, depending on the company’s data infrastructure and disclosure complexity.

Mixed-Level Engagements

ISSA 5000 expressly permits engagements where limited assurance is provided over some disclosures while reasonable assurance is provided over others within the same report. A company might seek reasonable assurance over greenhouse gas emissions, which carry the most regulatory and investor focus, while obtaining limited assurance over social metrics or governance disclosures that are harder to verify substantively. This tiered approach allows companies to concentrate higher-cost procedures where the credibility benefit is greatest.

ISSA 5000: The New Global Standard for Sustainability Assurance

The International Auditing and Assurance Standards Board (IAASB) finalized International Standard on Sustainability Assurance (ISSA) 5000, General Requirements for Sustainability Assurance Engagements, in November 2024. It is the first comprehensive, standalone global standard designed specifically for sustainability assurance engagements.

ISSA 5000 is principles-based and framework-neutral. It applies regardless of the sustainability reporting framework in use, whether that is the Global Reporting Initiative (GRI), the International Sustainability Standards Board (ISSB) standards, CSRD’s European Sustainability Reporting Standards (ESRS), or a company’s own bespoke criteria. The standard covers both limited and reasonable assurance, and it applies to all dimensions of sustainability, including environmental, social, and governance topics.

Effective date. ISSA 5000 is effective for assurance engagements covering sustainability information reported for periods beginning on or after December 15, 2026. Early application is permitted, and several large European practitioners have already adopted it ahead of that date.

Key Requirements Under ISSA 5000

ISSA 5000 introduces several notable requirements that differ from traditional financial statement auditing standards:

• Practitioner competence. The standard requires the engagement team to have sufficient knowledge of sustainability topics relevant to the subject matter, not just auditing technique. A team assuring Scope 3 greenhouse gas disclosures, for example, needs to understand emissions factor methodology and supply chain data collection.
• Risk at the assertion level. For reasonable assurance, risks must be assessed at the assertion level, paralleling the structure of ISA 315 for financial audits. For limited assurance, assessment is at the disclosure level.
• Transparency about criteria. The practitioner must evaluate whether the applicable criteria are suitable and available to users, and disclose any significant limitations in the criteria.
• Use of experts. ISSA 5000 addresses the practitioner’s use of sustainability experts, such as environmental engineers or social scientists, and the responsibilities that attach to that reliance.

The US Standards Landscape

In the United States, sustainability assurance has historically been performed under the AICPA’s attestation standards, primarily AT-C Section 205 (Examination Engagements, which is the US equivalent of reasonable assurance) and AT-C Section 210 (Review Engagements, which aligns with limited assurance).

The AICPA’s Auditing Standards Board (ASB) released an exposure draft on February 26, 2026, proposing revisions to AT-C Sections 105, 205, and 210 and introducing two new sustainability-specific AT-C sections aligned with ISSA 5000. The comment period closed June 30, 2026, with the final standard anticipated to be effective on or after June 15, 2029 (with early implementation permitted). US practitioners providing assurance before the finalized SSAE will continue to operate under existing AT-C standards, supplemented by AICPA sustainability-specific guidance.

For US companies with EU reporting obligations, ISSA 5000 is directly relevant now, since European regulators and auditors look to it as the applicable standard for CSRD assurance.

Choosing the Right Level of Assurance

Several factors should guide a company’s decision between limited and reasonable assurance.

Regulatory requirements. If a specific regulation mandates a level, that settles the question. CSRD requires limited assurance, and after the 2026 Omnibus simplification there is no longer a mandated escalation to reasonable assurance. The European Commission is due to adopt a dedicated limited assurance standard by July 1, 2027. Some companies may still elect reasonable assurance voluntarily for the credibility it signals.

Audience and use. Sustainability-linked debt instruments often specify the assurance level required. Investment-grade bond covenants, green loan terms, and supply chain questionnaires from major customers may each carry specific expectations. Before selecting a level, map who will be relying on the assured data and what they require.

Data readiness. Reasonable assurance requires strong, auditable underlying data. Companies that have invested in automated data collection, system-generated reports, and internal controls over sustainability reporting will find the incremental cost of reasonable assurance lower than those still relying on spreadsheets and manual aggregation. A readiness assessment before beginning the engagement can identify gaps and prioritize remediation.

Cost and resource capacity. Limited assurance is meaningfully less resource-intensive. For companies new to external verification, starting with limited assurance, strengthening data infrastructure, and then progressing to reasonable assurance over one to three years is a practical path.

Market positioning. For companies competing for capital or contracts where ESG performance is a differentiator, reasonable assurance over headline metrics sends a stronger credibility signal. The incremental cost of moving from limited to reasonable assurance on a targeted subset of disclosures, such as total carbon emissions, can be modest relative to the reputational return.

Modus’s audit and assurance team works with clients at every stage of this readiness curve, from initial gap assessments through full ISSA 5000-aligned assurance engagements.

Getting Your Organization Ready

Whether a mandate is on the horizon or a stakeholder request is already on the table, preparation matters. The gap between a self-reported ESG figure and one that can withstand external scrutiny is often larger than finance teams expect.

Build the data trail. Every reported metric needs a documented source, a defined methodology, and a clear chain of custody from operational system to final disclosure. The practitioner will trace figures back to origin; the smoother that path, the more efficient the engagement.

Document controls. Sustainability data passes through multiple hands, from facility managers to sustainability software to the finance or legal team that signs off on the report. Mapping and documenting the controls at each handoff reduces the risk of misstatement and demonstrates to the practitioner that the process is reliable.

Select applicable criteria early. ISSA 5000 requires that the practitioner evaluate the suitability of the criteria. Choosing a well-established, publicly available framework and applying it consistently from the start of the reporting period is far easier than retrofitting criteria after the fact.

Consider a readiness assessment. A pre-engagement readiness assessment, conducted by an assurance practitioner or an advisory team with ESG expertise, can identify control gaps, methodology weaknesses, and data quality issues before the formal engagement begins. Addressing those issues in advance reduces surprises and keeps the engagement timeline on track.

Modus’s AI-native approach to assurance work means systematic cross-referencing of source data against reported figures, source-linked workpapers, and faster cycle times, which can be especially valuable in sustainability engagements where underlying data is high-volume and comes from disparate operational systems.

Related reading: CSRD and US Companies: Does EU Sustainability Reporting Apply to You?

Frequently Asked Questions

What is ESG assurance?

ESG assurance is an independent engagement in which a qualified practitioner evaluates whether a company’s environmental, social, and governance disclosures are materially accurate and presented in accordance with applicable criteria. The practitioner issues a report expressing either a limited assurance conclusion (negative form) or a reasonable assurance opinion (positive form), providing stakeholders with independent confidence in the reliability of the reported information.

What is the difference between limited and reasonable assurance in ESG reporting?

Limited assurance involves primarily inquiry and analytical procedures, yielding a conclusion that nothing came to the practitioner’s attention suggesting material misstatement. Reasonable assurance involves more extensive procedures, including substantive testing and assertion-level risk assessment, and yields a positive opinion that the information is fairly presented in all material respects. Reasonable assurance provides a higher level of confidence but requires more time and data readiness.

What is ISSA 5000 and when does it take effect?

ISSA 5000 is the International Standard on Sustainability Assurance issued by the IAASB in November 2024. It is the first comprehensive global standard governing sustainability assurance engagements and covers both limited and reasonable assurance across all ESG topics and reporting frameworks. It is effective for sustainability information reported for periods beginning on or after December 15, 2026, with early application permitted.

Does the SEC require ESG assurance for US public companies?

As of September 2026, no. The SEC adopted a climate disclosure rule on March 6, 2024 and stayed it shortly after. The Commission voted to stop defending the rule on March 27, 2025 and proposed a formal rescission in June 2026. The comment period closed on August 3, 2026 and a final rescission vote is still pending. US public companies are not currently subject to a federal ESG assurance mandate, though large companies with EU market exposure may face CSRD assurance requirements.

Who typically performs ESG assurance engagements?

ESG assurance is performed by licensed audit firms and, in some jurisdictions, by accredited sustainability assurance providers. ISSA 5000 requires the engagement team to have both assurance competence and sufficient subject matter knowledge of the sustainability topics being assured. In practice, large accounting firms have built sustainability assurance practices, and mid-market firms with the relevant expertise are increasingly active in this space.

What frameworks can be used for ESG reporting that is subject to assurance?

ISSA 5000 is framework-neutral: it applies to sustainability information prepared under any recognized framework or criteria, including the ISSB’s IFRS Sustainability Disclosure Standards, CSRD’s European Sustainability Reporting Standards (ESRS), the Global Reporting Initiative (GRI), the Greenhouse Gas Protocol, or company-specific criteria. The practitioner must evaluate whether the chosen criteria are suitable and available to users of the report.